Forensic expert connecting write-blocker to hard drive